PHP ships emergency fixes for two critical 'PHP2Shell' flaws after attackers start probing days earlier
October 21, 2026 (Exploitation attempts from October 17, fixes October 21, 2026)
The PHP project released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, two critical flaws that let an unauthenticated attacker run code on a web server through PHP's memory handling and upload-progress feature. Researchers at Wiz, Calif and OpenAI are credited with finding them. Details leaked before the planned October 22 disclosure, so the release was brought forward. Amazon Threat Intelligence reports exploitation attempts from October 17, four days before the fixes, and says the flaws are now being broadly exploited, although it is unclear how many attacks succeed. The NSA advised taking sites that cannot be patched offline, and UK government websites went dark as a precaution. VulnCheck says hundreds of public proof-of-concept repositories exist but very few contain working exploits, and that it has built a working bypass of the ASLR memory protection.
Why it matters
PHP runs a large share of websites, so a long tail of unpatched and unsupported servers is expected. Defenders are warned not to assume the disclosure date was the earliest exploitation.
What defenders can take from it
- Update to a fixed PHP release now, or take sites that cannot be patched offline.
- Watch for unexpected child processes spawned by PHP workers such as php-fpm or Apache, a sign of exploitation.
- Inventory forgotten and out-of-support PHP installations, since those will stay exploitable.